Go/golang.org/x/crypto CVE-2026-39835: medium 5.3, EPSS 0.50%

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

Action: Upgrade golang.org/x/crypto to 0.52.0 or later.

go get golang.org/x/crypto@v0.52.0

Affected

Fixed versions

Sources

• osv: GO-2026-5015
• nvd: CVE-2026-39835
• https://go.dev/issue/79563
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://go.dev/cl/781660

CVE-2026-39835 · published 2026-05-22T02:08:34Z · modified 2026-09-22T10:41:48.922257369Z · JSON